Privacy notice
We collect as little personal data as we can, we never sell it, and analytics stays off unless you turn it on. Here are the details.
Effective date: October 13, 2026
Who we are
xsibility (“we”, “us”) is a digital accessibility services business operated as a venture of ESS ENN Associates and 172 Tech, with offices in Chicago, Illinois, USA and Chandigarh, India. We are the controller of the personal data described in this notice. Contact: hello@xsibility.com (subject line “Privacy”).
What we collect, why, and our legal basis
| Data | Purpose | Legal basis (GDPR / UK GDPR) | Retention |
|---|---|---|---|
| Name, email, organization, phone (optional), your message | Responding to your enquiry and preparing a proposal | Steps at your request before entering a contract (Art. 6(1)(b)); legitimate interests in responding to business enquiries (Art. 6(1)(f)) | Up to 24 months after our last contact, unless you become a client |
| Client contact and project records | Delivering services, invoicing, legal obligations | Contract (6(1)(b)); legal obligation (6(1)(c)) | Duration of the contract plus the period required by tax and accounting law |
| Analytics data (pages viewed, approximate location, device and browser type) — only if you opt in | Understanding which content is useful | Consent (6(1)(a)); you can withdraw at any time | 14 months in Google Analytics |
| Your cookie and theme choices, stored in your browser | Remembering your choices | Strictly necessary / legitimate interests | Until you clear your browser storage |
| Server logs (IP address, time, page requested, browser) | Security and preventing abuse | Legitimate interests (6(1)(f)) | Up to 30 days, unless needed to investigate an incident |
We don’t use your data for automated decision-making or profiling, and we don’t knowingly collect data from children under 16.
Analytics and cookies
We use Google Analytics 4 only if you click “Accept analytics” in our cookie banner. Until then, no analytics script is loaded and no analytics cookies are set. When enabled, we configure it to anonymize IP addresses and to disable Google signals and advertising features. If your browser sends a Global Privacy Control signal, we treat it as a refusal. You can change your choice at any time using Cookie settings in the footer. See our cookie policy.
We self-host our fonts, so loading this website doesn’t send your IP address to a font provider.
Who we share data with
We don’t sell or rent personal data, and we don’t “share” it for cross-context behavioral advertising. We use these processors:
- Formspree, Inc. (USA) — receives contact form submissions and forwards them to us.
- Google LLC (USA) — analytics, only with your consent.
- Our web hosting provider — stores server logs.
- Email and office software providers — to communicate with you.
- ESS ENN Associates and 172 Tech, our parent ventures, for administration and service delivery.
We may disclose data if required by law or to protect our legal rights.
International transfers
We operate in the United States and India, and our processors are mainly in the United States. When we transfer personal data from the EU, EEA, UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK addendum), or on the EU-US Data Privacy Framework where a recipient is certified.
Your rights
EU, EEA and UK residents have the right to access, correct, delete, restrict or object to processing of their data, to data portability, and to withdraw consent at any time. You may complain to your local data protection authority.
California residents (CCPA/CPRA) have the right to know what personal information we collect and how it’s used, to delete it, to correct it, to opt out of sale or sharing (we do neither), and to limit use of sensitive personal information (we don’t collect it for that purpose). We won’t discriminate against you for exercising these rights.
Residents of other US states with privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others) have similar rights to access, correct, delete and opt out, and to appeal our decision on a request.
To exercise any right, email hello@xsibility.com with “Privacy request” in the subject. We’ll respond within 30 days (45 days where US state law allows), and may need to verify your identity. You may use an authorized agent. To appeal a decision, reply to our response with “Appeal” in the subject.
Security
We use HTTPS everywhere, restrict access to personal data to people who need it, and require our processors to protect it. No system is perfectly secure; if a breach affects you, we will notify you and the authorities as required by law.
Changes
We’ll post any changes here and update the effective date. Significant changes will be highlighted on the home page.