Privacy Policy

1. Introduction

Welcome to xeoVision, an application provided by Creoox AG, Landstrasse 40, 9495 Triesen, Liechtenstein (“we,” “us,” “our”). We are committed to protecting your privacy and ensuring compliance with the General Data Protection Regulation (GDPR) and other applicable privacy laws. This Privacy Policy explains how we handle your data when you use xeoVision.

2. Data Collection and Processing

User Authentication and Account Data: Certain features of xeoVision may require user authentication. In these cases, we collect basic personal data such as email address and login metadata. This data is processed using Zitadel, a third-party identity and access management platform. The collected data is used solely for authentication, session management, and platform security.

Model Processing: When you upload 3D/BIM models to xeoVision, we process these files for viewing purposes and to further develop and improve our technology. These files are handled in accordance with this Privacy Policy and are not linked to any personal identifiers.

Profiling: xeoVision does not use automated decision-making or profiling based on the data you upload.

2a. Analytics

We use Google Analytics 4 (GA4), Microsoft Clarity (MS Clarity) and HubSpot to obtain insights into how visitors use xeo.vision and to improve the website’s functionality and performance. HubSpot may also be used to display call-to-action elements on the website such as slide-in messages. These technologies are technically initiated when you visit the site; however, their operation depends on the cookie preferences you select in our consent banner.

No advertising or profiling. Irrespective of your consent decision:

• We do not use advertising cookies.
• We do not engage in behavioral advertising or user profiling.
• No tracking occurs across third-party websites.

Analytics data is handled securely and processed in accordance with GDPR solely for understanding website usage and improving xeo.vision.

If you consent to analytics cookies (“Accept”)

• GA4, MS Clarity and HubSpot may store and read analytics cookies on your device.
• All data collected is used exclusively for aggregated usage analysis and website optimization.
• IP addresses are anonymized and advertising or cross-site profiling features are disabled.

When you click “Reject”

• GA4, MS Clarity and HubSpot do not store or read any analytics cookies.
• GA4, MS Clarity and HubSpot operate in a restricted, cookieless mode, collecting only aggregated, non-identifying technical events.
• No user profiles, cross-site tracking, or personal identifiers are created.

For more information on MS Clarity, GA4, HubSpot and how they handle data, please refer to: Microsoft’s Privacy Statement, MS Clarity FAQs, MS Clarity Terms & Conditions, HubSpot Privacy Policy, HubSpot Product Privacy Policy, HubSpot Tracking Code – Do Not Track, Google Analytics Terms of Service, Google Analytics Data Safeguards (EU-specific), Google privacy policy.

If you have questions or concerns regarding data processing within xeoVision, please contact us at dataprotection@creoox.com.

3. Legal Basis for Processing

We process your 3D/BIM models and use strictly necessary cookies based on our legitimate interest to provide, maintain, and improve the functionality of xeoVision. For features requiring login, we process authentication data based on contractual necessity or, where applicable, based on your consent. By using our service, you acknowledge and agree to the processing activities outlined in this Privacy Policy.

Depending on the type of processing, we rely on the following legal bases:

• Art. 6(1)(f) GDPR – legitimate interests (anonymous technical data, security, site operation).
• Art. 6(1)(a) GDPR – consent (optional analytics cookies and tools).
• Art. 6(1)(b) GDPR – contract or pre-contractual steps (account features, and if you contact us to request information).

4. Data Storage and Security

Hosting and Storage: All data processing for xeoVision takes place on servers located within the EU. We do not transfer data outside of the European Economic Area (EEA). In case of future transfers, we will ensure that appropriate safeguards, such as Standard Contractual Clauses, are in place to protect your data. Our backend infrastructure is hosted with Exoscale, a cloud provider with data centers located within the European Union. Exoscale adheres to stringent security standards, ensuring that all data processed by xeoVision is managed in compliance with GDPR and other applicable data protection regulations. Exoscale is member of Gaia-X (European Association for Data and Cloud AISBL), OCRE (Open Clouds for Research Environments), The Linux Foundation and Cloud Native Computing Foundation. This partnership allows us to maintain secure and reliable hosting for your data, with encryption and access controls in place to protect your information.

Data Retention: We may store anonymized versions of the uploaded models for ongoing research and development purposes. These anonymized models are not associated with any personal data and are kept securely.

5. Your Rights Under GDPR

In accordance with GDPR, individuals have certain rights regarding their personal data, including the right to access, rectification, erasure, restriction of processing, and objection. If you create an account within xeoVision, you may exercise these rights by contacting us at dataprotection@creoox.com.

Should you have any questions or concerns about our data practices, please feel free to contact us at dataprotection@creoox.com.

6. Data Sharing and Disclosure

No Third-Party Sharing: We do not share your data with third parties unless required by law or in response to lawful requests by public authorities.

Anonymized Processing: Any processing we conduct on uploaded models is done in an anonymized way and used solely for the improvement of our technology.

7. Changes to the Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices. Any updates will be posted on this page with a new effective date.

8. Contact Information

If you have any questions about this Privacy Policy, please contact us at:

Creoox AG, Landstrasse 40, 9495 Triesen, Liechtenstein Email: dataprotection@creoox.com

9. Newsletter Subscription

When you subscribe to our newsletter, we collect your email address for the purpose of sending you updates, news, and promotional content.

We process your email based on your explicit consent. You can withdraw this consent at any time by unsubscribing. We do not share your email with third parties for marketing purposes.

We use Mailjet, a third-party email service provider, to manage and distribute our newsletters. Mailjet processes your email address solely for the purpose of delivering the newsletter on our behalf. Mailjet complies with GDPR and ensures that your data is handled securely and in accordance with privacy regulations. For more information about Mailjet’s privacy practices, you can review Mailjet’s Privacy Policy.

10. Feedback and Issue Reporting via Sentry

When using the Sentry feedback widget to report issues, users have the option to provide their business email address. This information is collected only if the user chooses to provide it and is used solely for communication regarding the reported issue.

We process the email address provided based on the user’s explicit consent. Users can choose not to provide an email and still submit feedback.

The email address will only be used to follow up on the feedback submitted. It is not shared with third parties unless it is necessary for addressing the issue.

11. Cookie Policy

When you first visit xeo.vision, you can choose whether to allow or reject analytics cookies.

• Essential cookies: required for the website to function (always active).
• Analytics cookies: used only if you choose “Accept.”

You can withdraw or change your cookie preferences at any time via Cookie Preferences or by adjusting your browser settings. We don’t use advertisement cookies or profiling features.

12. Use of SalesViewer® technology

This website uses SalesViewer® technology from SalesViewer® GmbH on the basis of the website operator’s legitimate interests (Section 6 paragraph 1 lit.f GDPR) in order to collect and save data on marketing, market research and optimization purposes.

To do this, a JavaScript based code, which serves to capture company-related data and according to website usage. The data captured using this technology are encrypted in a non-retrievable one-way function (so-called hashing). The data is immediately pseudonymized and is not used to identify website visitors personally.

The data stored by SalesViewer® will be deleted as soon as they are no longer required for their intended purpose and there are no legal obligations to retain them.

The data recording and storage can be repealed at any time with immediate effect for the future, by clicking on https://www.salesviewer.com/opt-out to prevent SalesViewer® from recording your data. In this case, an opt-out cookie for this website is saved on your device. If you delete the cookies in the browser, you will need to click on this link again.

13. DDoS Protection and Cloudflare Captcha

To protect our application from DDoS attacks and ensure the security and stability of our application, we use Cloudflare’s Captcha service. This service may occasionally display a simple checkbox prompt asking users to confirm they are human if certain actions occur too quickly after page loading.

The Cloudflare Captcha may collect technical information, such as IP addresses and browser details, to assess potentially suspicious activity and maintain security. This data is processed by Cloudflare in compliance with GDPR.

The data collected by Cloudflare Captcha is used solely for security and fraud prevention, helping us to maintain a safe and reliable service.

For more details on Cloudflare’s data handling practices, please refer to the Cloudflare Privacy Policy.

14. User Authentication via Zitadel

xeoVision uses Zitadel, an identity and access management solution provided by CAOS AG, for secure user authentication. When you register or log in, we collect your email address and metadata necessary for login. This information is processed solely to manage your account and ensure secure access to the platform.

Zitadel processes your data in compliance with GDPR. For more information, please refer to Zitadel’s Privacy Policy: https://docs.zitadel.com/legal/privacy-policy.

Authentication data is stored only for as long as needed to maintain your account or as required by law. You may request deletion of your account by contacting dataprotection@creoox.com.

Single Sign-On (SSO) via Third-Party Identity Providers:

xeoVision supports Single Sign-On (SSO) through third-party identity providers including Google, Microsoft, and GitHub. When you choose to log in using one of these providers, you are first presented with a consent screen from the provider. If you accept, the provider shares certain personal data (such as your name and email address) with us via Zitadel.

We process this data solely for the purposes of account creation, login management, and to maintain the security of your session. This processing is based on your explicit consent or as necessary for the performance of a contract.

These third-party providers operate as independent data controllers for their part of the authentication process. For more information, please review their privacy policies:

• Google: https://policies.google.com/privacy
• Microsoft: https://privacy.microsoft.com/
• GitHub: https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement

15. File Import via Microsoft OneDrive

xeoVision allows you to import 3D/BIM models directly from your Microsoft OneDrive account. When you use this feature, you are first required to log into your Microsoft account and grant explicit consent to share access to the file you choose. This consent is managed and provided through Microsoft’s secure OAuth interface.

Once you approve access, only the specific file you select is retrieved and uploaded to xeoVision. We do not access, browse, or store any other content in your OneDrive.

The imported file is processed solely for visualization and improvement of our service, in accordance with this Privacy Policy. The data is handled securely, and any retained content is anonymized as described in our Data Storage and Security section.

Microsoft acts as an independent data controller during the authentication and file selection process. For more information, please see the Microsoft Privacy Statement.

16. Payment Processing via Stripe

We use Stripe as our third-party payment processor to handle all payment transactions for xeoVision subscriptions. When you purchase a subscription, Stripe collects your payment information (e.g., credit card number, billing address) directly. We do not store or process your full payment details on our servers.

The personal data you provide in connection with your purchase — such as name, billing address, email, and IP address — may be shared with Stripe for the purpose of processing your payment, verifying identity, preventing fraud, and fulfilling your order.

This processing is based on contractual necessity and our legitimate interest in offering secure and reliable billing functionality. For more information, please refer to Stripe’s Privacy Policy.